Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

Medium severity, with a CVSS score of 5.2, published 26 June 2026.

Is there a fix for This vulnerability?

A patch was published on 2026-05-23: Fixes committed to repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is This vulnerability attacked?

It is attacked with local access, in a software library.

Check whether you run nono-py (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

nono-py sandbox escape in network policy enforcement

Severity: medium · CVSS 5.2 · Published 2026-06-26

nono-py is a Python library used to run code in a restricted sandbox environment. A vulnerability in how it handles security policies allows sandboxed applications to bypass network restrictions and access the internet directly instead of through a controlled proxy. This could lead to unauthorized data transmission or access to internal network resources that should have been blocked.

Technologies: nono-py (PyPI). Vendors: PyPI.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: Medium severity, with a CVSS score of 5.2, published 26 June 2026.
Which products and versions are affected?: nono-py (PyPI) <= 0.10.0.
Is there a fix for This vulnerability?: A patch was published on 2026-05-23: Fixes committed to repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?: It is attacked with local access, in a software library.
Am I affected?: Check whether you run nono-py (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

nono-py's policy handling contains two primary flaws that lead to a 'fail open' state. First, the resolution of policy-derived ProxyConfig objects did not automatically enforce CapabilitySet.proxy_only, allowing sandboxed child processes to bypass domain allowlists via direct network access. Second, the policy JSON parser accepted unknown fields without error, meaning misspelled or unsupported security restrictions were silently ignored. On Linux, the fix involves utilizing Landlock ABI v4 or a seccomp supervisor fallback to intercept and validate connect and bind syscalls. Attackers with the ability to execute code within the sandbox can exploit this to reach unauthorized network destinations. The vulnerability is addressed in version 0.10.1.

Affected products

nolabs-ai nono-py <= 0.10.0

Timeline

2026-05-23: disclosed
2026-06-26: advisory: GitHub Advisory published
2026-05-23: patched: Fixes committed to repository

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.